External risk intelligence

Oracle Business Process Management Suite Human Workflow Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-91222

The vulnerability affects the Human Workflow component of Oracle Business Process Management Suite, which is accessed via SOAP. While these components often reside within internal enterprise middleware environments, they may be exposed in some deployments to support integrated business processes or external services, making network reachability possible but not inherently public-facing by design.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists within Oracle Business Process Management Suite that could allow an attacker with limited access to take control of the system. While this specific product is affected, successful attacks might also impact other connected Oracle products. The highest possible CVSS score indicates a severe risk to confidentiality, integrity, and availability.

A system flaw impacts Oracle's business process software.
It allows unauthorized control of business processes.
Confirm relevance and understand potential system compromise.

Attack Path

How an attacker could exploit the issue

An attacker with limited privileges can exploit this vulnerability by sending specially crafted SOAP messages over the network to the Human Workflow component of Oracle Business Process Management Suite. This component is part of Oracle Fusion Middleware. Successful exploitation could allow an attacker to gain complete control over the Oracle Business Process Management Suite, potentially affecting other connected products.

Network access via SOAP required.
Vulnerable Human Workflow component is triggered.
Complete takeover of the affected suite is possible.

Live Threat

Current exploitation, exposure, and threat context

A low-privileged attacker with network access can exploit this vulnerability in Oracle Business Process Management Suite, potentially leading to a complete takeover of the system. This could affect the confidentiality, integrity, and availability of the affected product and possibly other integrated products when supported by the advisory.

System data and service control at risk.
Network access via SOAP could lead to exposure.
Complete takeover of the affected system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Action for this vulnerability will likely involve Oracle application owners, the platform team managing Fusion Middleware, and the security team for exposure assessment. The first practical step is to identify all instances of Oracle Business Process Management Suite, confirm their network reachability and business criticality, and then engage with the accountable owners to plan remediation based on the assessed risk.

Application owners should lead remediation efforts.
Verify network exposure and business criticality first.
Coordinate vendor engagement for fixes.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Business Process Management Suite?

It is a component of Oracle Fusion Middleware designed to automate and manage complex business workflows. Organizations use this suite to orchestrate tasks, coordinate human interactions, and integrate diverse applications within their enterprise environment. The specific Human Workflow component handles user-facing tasks and process approvals.

What kind of vulnerability is CVE-2026-91222?

This is a critical security flaw categorized by a high CVSS score, indicating a severe risk. It represents a weakness in how the Human Workflow component processes incoming requests. Successfully exploiting this flaw allows an attacker to achieve full control over the application, compromising the confidentiality, integrity, and availability of the entire suite.

How is this vulnerability triggered?

The flaw is triggered when an attacker with low-level system privileges sends a specially crafted SOAP message to the Human Workflow component over a network. Importantly, this vulnerability requires active network interaction to exploit; it is not triggered by standard, authorized administrative use or by simply logging into the system.

Do I need to worry if my system is internal?

Halo Surface Signal notes that while these components are typically hosted in internal middleware environments, they may be accessible in some setups to support integrated business processes. You should care if your Human Workflow instance is reachable over the network, even if it is not directly exposed to the public internet.

How should I respond to this threat?

Start by identifying all instances of Oracle Business Process Management Suite in your environment to understand your footprint. Prioritize verifying which instances are reachable over your network and assess their business criticality. Coordinate with the teams managing your Fusion Middleware to plan for vendor-provided updates.

References

www.oracle.com/security-alerts/cpuoct2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.